NTFS Alternate Data Stream Execution - System Utilities

Hypothesis and description

NTFS Alternate Data Streams (ADSs) may be used by adversaries as a means of evading security tools by storing malicious data or binaries in file attribute metadata. ADSs are also powerful because they can be directly executed by various Windows tools; accordingly, this analytic looks at common ways of executing ADSs using system utilities such as powershell.

Platforms: Windows
Domain: Host
Subtypes: Process
Submitted: 2020-08-03
Contributors: MITRE

ATT&CK coverage

Technique	Tactics	Coverage
T1564 Hide ArtifactsT1564.004	Stealth (formerly Defense Evasion)	Low

1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1564Hide Artifacts
.004 NTFS File Attributes

D3FEND techniques MITRE maps to this analytic

D3-PSA Process Spawn Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

Pseudocode and implementations

PseudocodeNTFS ADS - pseudocodeData model: CAR native

This is generic pseudocode that lines up with the below Splunk queries.

processes = search Process:Create
ads_processes = filter processes where (
exe == "powershell.exe OR rundll32.exe OR wmic.exe OR wscript.exe OR cscript.exe" and command_line.matches("__some_regex__")
)
output ads_processes

SplunkNTFS ADS - powershellData model: Sysmon native

This Splunk query looks for invocations of powershell used to execute NTFS alternate data streams.

index=__sysmon_index__ EventCode=1 Image=C:\\Windows\\*\\powershell.exe|regex CommandLine="Invoke-CimMethod\s+-ClassName\s+Win32_Process\s+-MethodName\s+Create.*\b(\w+(\.\w+)?):(\w+(\.\w+)?)|-ep bypass\s+-\s+<.*\b(\w+(\.\w+)?):(\w+(\.\w+)?)|-command.*Get-Content.*-Stream.*Set-Content.*start-process .*(\w+(\.\w+)?)"

SplunkNTFS ADS - wmicData model: Sysmon native

This Splunk query looks for invocations of WMIC used to execute NTFS alternate data streams.

index=__sysmon_index__ EventCode=1 Image=C:\\Windows\\*\\wmic.exe | regex CommandLine="process call create.*\"(\w+(\.\w+)?):(\w+(\.\w+)?)"

SplunkNTFS ADS - rundll32Data model: Sysmon native

This Splunk query looks for invocations of rundll32 used to execute NTFS alternate data streams.

index=__sysmon_index__  EventCode=1 Image=C:\\Windows\\*\\rundll32.exe | regex CommandLine="\"?(\w+(\.\w+)?):(\w+(\.\w+)?)?\"?,\w+\|(advpack\.dll\|ieadvpack\.dll),RegisterOCX\s+(\w+\.\w+):(\w+(\.\w+)?)\|(shdocvw\.dll\|ieframe\.dll),OpenURL.*(\w+\.\w+):(\w+(\.\w+)?)"

SplunkNTFS ADS - wscript/cscriptData model: Sysmon native

This Splunk query looks for invocations of the windows scripting host used to execute NTFS alternate data streams.

index=__sysmon_index__ EventCode=1 (Image=C:\\Windows\\*\\wscript.exe OR Image=C:\\Windows\\*\\cscript.exe) | regex CommandLine="(?<!\/)\b\w+(\.\w+)?:\w+(\.\w+)?$"

References (from MITRE CAR)

Oddvar Moe has created an excellent NTFS ADS execution reference here on github, which was used as the basis for many of these analytics.
The LOLBAS project is an amazing resource for anything LOLBAS.

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

16 more in the full list

View CAR-2020-08-001 on car.mitre.org